Fallos del tipo CWE-611

648 resultados

Processamento Inseguro de XML Externo (XXE)

Ocorre quando a aplicação processa XML sem desabilitar ou validar entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML resolve essas entidades e expõe dados sensíveis ou permite ataques de negação de serviço.

Ejemplo

Um serviço web que aceita XML de upload processa um arquivo contendo <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>. O parser resolve a entidade e retorna o conteúdo do arquivo no erro ou resposta, ou um atacante injeta billion laughs attack para consumir memória do servidor.

Cómo mitigar

Desabilite explicitamente DTDs e entidades externas no parser XML (em Java, use XMLConstants.ACCESS_EXTERNAL_DTD = ""; em Python, use defusedxml ou desabilite resolve_entities; sempre valide e sanitize entrada XML contra schema predefinido).

CVE-2026-94108HIGHgetID3 through 1.9.26 XML External Entity Injection via XML2arrayEPSS 0.4%CVE-2025-5877MEDIUMFengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity referenceEPSS 0.4%CVE-2025-65868CRITICALXML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST requesEPSS 0.4%CVE-2026-89260HIGHMoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback EndpointEPSS 0.4%CVE-2022-45194LOWCBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.EPSS 0.4%CVE-2025-10713MEDIUMXML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationEPSS 0.4%CVE-2026-32251CRITICALTolgee has an XXE Injection in Translation ImportEPSS 0.4%CVE-2024-49535MEDIUMAcrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.4%CVE-2025-24521MEDIUMKeysight Ixia Vision Product Family Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2025-30018HIGHMultiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)EPSS 0.4%CVE-2025-24910MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2024-21048MEDIUMVulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: XML input). Supported versioEPSS 0.4%CVE-2025-31497HIGHTEIGarage XML External Entity (XXE) Injection in Document Conversion ServiceEPSS 0.4%CVE-2025-11035MEDIUMJinher OA text xml external entity referenceEPSS 0.4%CVE-2025-4639HIGHImproper Restriction of XML External Entity Reference in PeergosEPSS 0.4%CVE-2018-0100—A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have EPSS 0.4%CVE-2025-6438MEDIUMA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API callsEPSS 0.4%CVE-2024-8602MEDIUMXML Eternal Entity Attack in the Software Library taxstatement.jarEPSS 0.4%CVE-2026-65432HIGHApache CXF: XXE via WSDL/XSD import parsingEPSS 0.4%CVE-2026-82578HIGHNextGen Healthcare Mirth Connect Improper Restriction of XML External Entity ReferenceEPSS 0.4%